pyrox.dev
Merge pull request #181197 from bjornfor/fix-ddclient-password-leak
+3
-4
nixos/modules/services/networking/ddclient.nix
+3
-4
nixos/modules/services/networking/ddclient.nix
···
13
13
foreground=YES
14
14
use=${cfg.use}
15
15
login=${cfg.username}
16
-
password=${lib.optionalString (cfg.protocol == "nsupdate") "/run/${RuntimeDirectory}/ddclient.key"}
16
+
password=${if cfg.protocol == "nsupdate" then "/run/${RuntimeDirectory}/ddclient.key" else "@password_placeholder@"}
17
17
protocol=${cfg.protocol}
18
18
${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
19
19
${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
···
33
33
${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
34
34
install ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
35
35
'' else if (cfg.passwordFile != null) then ''
36
-
password=$(printf "%q" "$(head -n 1 "${cfg.passwordFile}")")
37
-
sed -i "s|^password=$|password=$password|" /run/${RuntimeDirectory}/ddclient.conf
36
+
"${pkgs.replace-secret}/bin/replace-secret" "@password_placeholder@" "${cfg.passwordFile}" "/run/${RuntimeDirectory}/ddclient.conf"
38
37
'' else ''
39
-
sed -i '/^password=$/d' /run/${RuntimeDirectory}/ddclient.conf
38
+
sed -i '/^password=@password_placeholder@$/d' /run/${RuntimeDirectory}/ddclient.conf
40
39
'')}
41
40
'';
42
41